fix(update-check): surface failed preamble checks

[maxpetrusenkoagent]

Summary

• Add a CHECK_FAILED exit=<n> cmd=<cmd> stdout sentinel for abnormal gstack-update-check failures.
• Preserve existing quiet behavior for up-to-date, snoozed, disabled, and network-unavailable checks.
• Keep telemetry fire-and-forget paths from triggering false CHECK_FAILED output.

Fixes #1974.

Root cause

Skill preambles invoke gstack-update-check with stderr suppressed and || true, so a local script crash was indistinguishable from an up-to-date/no-output result. With set -euo pipefail, state-file write/remove failures could terminate before the remote version was checked.

Verification

• bash -n bin/gstack-update-check
• bun test browse/test/gstack-update-check.test.ts test/skill-validation.test.ts → 369 pass, 0 fail on fork-base branch after cherry-picking the fix
• git diff --check
• bun run gen:skill-docs --dry-run --host claude → fresh
• bun run gen:skill-docs --dry-run --host codex → fresh
• bun run skill:check was attempted; it fails on pre-existing missing/stale optional host outputs (.factory, .kiro, .opencode, .slate, .cursor, .openclaw, .hermes, .gbrain). Claude and Codex generated outputs are fresh.

Autoreview

• Claude subagent review: no blocking findings. One non-blocking test determinism caveat noted for privileged/root runners.
• Codex review pass 1: requested exact preamble-wrapper coverage.
• Added exact two-leg generated preamble wrapper regression test.
• Codex final review: CLEAN: no findings.

Fork note

The branch is based on the current maxpetrusenkoagent/gstack:main fork tip because the fork cannot be server-synced past upstream workflow-file commits without GitHub workflow OAuth scope. The PR diff against garrytan/gstack:main contains only this focused fix.

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[maxpetrusenkoagent]

Autoreview after latest force-push: Codex reviewed the exact GitHub PR diff for #1982 and returned CLEAN: no findings. Local verification on the pushed branch: bash -n bin/gstack-update-check, bun test browse/test/gstack-update-check.test.ts test/skill-validation.test.ts (369 pass, 0 fail), and git diff --check. Note: GitHub currently reports no checks for this fork draft PR.